web.config + asp.net MVC + location > system.web > authorization + Integrated Security

Question

Hi guys

I have an ASP.Net MVC app using Integrated Security that I need to be able grant open access to a specific route.

The route in question is '~/Agreements/Upload' and the config I have setup looks like this:

<configuration> 
    ...
 <location path="~/Agreements/Upload">
      <system.web>
          <authorization>
               <allow users="*"/>
          </authorization>
      </system.web>
 </location>
    ...
</configuration> 

I have tried a few things and nothing has worked thus far.

In IIS under Directory Security > Authentication Methods I only have "Integrated Windows Authentication" selected. Now this could be part of my problem (as even though IIS allows the above IIS doesn't). But if that's the case how do I configure it so that Integrated Security works but allows people who aren't authenticated to access the given route.

Cheers Anthony

Answer 1

You need to allow anonymous access in IIS as well, as otherwise only windows authenticated users will be able to access anywhere in your site.

You should be able to get your desired behaviour by adding

<deny users="?"/>
<allow users="*"/>

to the main web.config to deny access by default to anonymous users.

In your <location> section, then change this to be

<allow users="?"/>

so that anonymous users can get to that part.

Answer 2

I don't think you can use virtual paths (starting with "~/") in the path attribute. You have to specify paths relative to the location of the Web.config file you are working in.

You can also place a separate Web.config file in the Upload folder with the following content:

<configuration>
  <system.web>
    <authorization>
      <allow users="*"/>
    </authorization>
  </system.web>
</configuration>